File Station 5 CVE-2026-24723

Exploitation requires the attacker to first obtain a valid File Station 5 user account (PR:L) - it is NOT unauthenticated. The attack is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but impact is limited to a denial of service (availability only; no confidentiality or integrity impact). It affects File Station 5 versions prior to 5.5.6.5243; upgrading to 5.5.6.5243 or later remediates it. The authentication prerequisite and availability-only outcome are the primary limiting factors that keep real-world risk low.

This is a genuinely low-priority issue, and the available signals are internally consistent rather than conflicting. The QNAP-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable but authenticated flaw (PR:L) whose only impact is low availability (VA:L) with no confidentiality or integrity impact - matching the description of an authenticated DoS via NULL pointer dereference (CWE-476). The vendor-assigned base score of 1.3 reflects that limited blast radius. The vector explicitly carries E:U (exploit maturity: Unreported/unproven), and there is no CISA KEV listing and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score or SSVC decision data was supplied, so probability-of-exploitation cannot be quantified, but the combination of required authentication, availability-only impact, and lack of exploit maturity means this is a low-CVSS, low-real-risk issue - not a priority outside hardening/patch-hygiene cycles. One nuance: the description says the attacker must 'gain a user account,' which aligns with PR:L and does not contradict the network vector.

An attacker who already holds a valid (even low-privileged) File Station 5 user account sends a crafted request over the network that triggers a NULL pointer dereference in the application, crashing the service and denying file-access functionality to legitimate users. No public exploit code is identified, and the flaw yields only a denial of service - no data disclosure or code execution.